vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

run opted-in agents in a user namespace with a dedicated data owner

Browse source
This commit is contained in:
atlas 2026-11-01 13:50:53 +01:00 • committed by mara
commit bfdf603d12
1 changed files with 828 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

17
nix/host-modules/lib/userns-data-owner.nix Normal file
View file

@ -0,0 +1,17 @@
# What is wrong with a uid:gid chosen as the on-disk owner of a user-namespaced
# agent's data. Empty when it is fine.
{ lib }:
{
owner,
# Every uid and gid the host defines, from `users.users` and `users.groups`.
uids,
gids,
}:
lib.optional (
owner < 30000
) "${toString owner} is in the range NixOS gives normal users and system users (below 30000)"
++
lib.optional (owner >= 61184)
"${toString owner} is in the range systemd allocates dynamic users from (61184 and above), or is `nobody`"
++ lib.optional (builtins.elem owner uids) "${toString owner} is the uid of a user the host defines"
++ lib.optional (builtins.elem owner gids) "${toString owner} is the gid of a group the host defines"